---
title: "Get Tokens By Code"
method: POST
path: "/get-tokens-by-code"
tags: ["developers"]
---

# Get Tokens By Code

`POST /get-tokens-by-code`

Get tokens by code

## Headers

- `Authorization` string

## Request body

- object
  - `oxd_id` string, required
  - `code` string, required
  - `state` string, required

## Response `200`

OK

- object
  - `access_token` string, required
  - `expires_in` integer, required
  - `id_token` string, required
  - `refresh_token` string, required
  - `id_token_claims` object, required
    - `at_hash` string[], required
    - `aud` string[], required
    - `sub` string[], required
    - `auth_time` string[], required
    - `iss` string[], required
    - `exp` string[], required
    - `iat` string[], required
    - `nonce` string[], required
    - `oxOpenIDConnectVersion` string[], required

## Other responses

- `400` — Invalid parameters are provided to endpoint.
- `403` — Forbidden. Invalid access token provided in Authorization header.
- `500` — Internal error occured. Please check oxd-server.log file for details (usually located in /var/log/oxd-server/oxd-server.log).

## Changes

- **2018-11-30** `c28eaefdb285` — 5 breaking, 1 warning
  - removed the request body
  - removed the media type `application/json` for the response with the status `200`
  - removed the media type `application/json` for the response with the status `400`
  - removed the media type `application/json` for the response with the status `403`
  - …2 more

[Change history](https://skmtc.dev/gluufederation/apis/oxd-server/changes/get-tokens-by-code/post.md)

---

[API](https://skmtc.dev/gluufederation/apis/oxd-server.md) · [All operations](https://skmtc.dev/gluufederation/apis/oxd-server/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/gluufederation/oxd-server/revisions/c28eaefdb285/schema)